Splunk Search

How to compute next cron iteration from _raw event?

cdaviet
Explorer

Hi,

I have a last run epoch time and a cron schedule (i.e. : "*/5 * * * *") in an _raw event and I'd like to parse these information to output the next run.

Do you have any idea how to do this?

I found this addon :https://splunkbase.splunk.com/app/4078/ but it does not allow me to use a custom "last run time" and always takes the earliest time of my search as an input.

Thanks :slightly_smiling_face:

Labels (1)
Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

cdaviet
Explorer

I tried it but I've got errors using the command

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I'm not sure what you are trying, but if you want to schedule the next run 5min after the current has ended then you can just use interval instead of cron expression. Then the next run starts after that interval. It start counting from the end on current/previous run.

r. Ismo

0 Karma

cdaviet
Explorer

No, the cron expression is in the _raw event. I don't have the interval.

 
 
0 Karma

isoutamo
SplunkTrust
SplunkTrust
So you want to get the next run time for that schedule?
0 Karma

cdaviet
Explorer

Yes :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...